URL:

https://connectfansus.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwYWdhbWVudG8ub2dydXBvaW1wdWxzZS5jb20lMkZMR2tO&sig=HEz1yAE3AnqPuE1E5x2B85npNv9apJBriEfD1oZFcDeu&iat=1709127434&a=%7C%7C801579481%7C%7C&account=connectfansus.activehosted.com&email=RWpwN3ZZGJSMM3y4VAS9azF01WqVKzNpZVcpdrf6UFhM8Ew%3D%3AQ7K7ypPXKwbvTegOw5FKpT%2BzdPVOoq5N&s=be6ec883b9846ec07ebc65a9eb80278b&i=3875A4218A1A15249

Full analysis: https://app.any.run/tasks/9198a973-6d7a-4e02-bf62-feb70b947127
Verdict: Malicious activity
Analysis date: February 29, 2024, 06:20:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6B8899BF1F12BAF0A84AAF64AD972255

SHA1:

AA23C97AABF8E82B762492BE1E29F7866DED1C2B

SHA256:

35A46AD9C1FD11AA3766432F293BC4769D24F2B2CCF935CE2638E877AD10B1DA

SSDEEP:

12:2d3WUglSm0mMPCenvF9CDJrZh21hT0k/RF6:2dTgY/CenbSJrZh+iEF6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msdt.exe (PID: 956)

    • Reads settings of System Certificates

      • msdt.exe (PID: 956)

    • Reads the Internet Settings

      • sdiagnhost.exe (PID: 3164)

    • Process uses IPCONFIG to discover network configuration

      • sdiagnhost.exe (PID: 3164)

    • Uses ROUTE.EXE to obtain the routing table information

      • sdiagnhost.exe (PID: 3164)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3240)

    • Drops the executable file immediately after the start

      • msdt.exe (PID: 956)

    • Reads the software policy settings

      • msdt.exe (PID: 956)

    • Reads security settings of Internet Explorer

      • msdt.exe (PID: 956)
      • sdiagnhost.exe (PID: 3164)

    • Create files in a temporary directory

      • sdiagnhost.exe (PID: 3164)
      • makecab.exe (PID: 2724)
      • msdt.exe (PID: 956)

    • Creates files or folders in the user directory

      • msdt.exe (PID: 956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe msdt.exe no specs sdiagnhost.exe no specs ipconfig.exe no specs route.exe no specs makecab.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
956 -modal 1114548 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\admin\AppData\Local\Temp\NDF2C6A.tmp -ep NetworkDiagnosticsWebC:\Windows\System32\msdt.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msdt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Windows\system32\ROUTE.EXE" printC:\Windows\System32\ROUTE.EXE—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\route.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2724"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddfC:\Windows\System32\makecab.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\makecab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2832"C:\Windows\system32\ipconfig.exe" /allC:\Windows\System32\ipconfig.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3164C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3240"C:\Program Files\Internet Explorer\iexplore.exe" "https://connectfansus.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwYWdhbWVudG8ub2dydXBvaW1wdWxzZS5jb20lMkZMR2tO&sig=HEz1yAE3AnqPuE1E5x2B85npNv9apJBriEfD1oZFcDeu&iat=1709127434&a=%7C%7C801579481%7C%7C&account=connectfansus.activehosted.com&email=RWpwN3ZZGJSMM3y4VAS9azF01WqVKzNpZVcpdrf6UFhM8Ew%3D%3AQ7K7ypPXKwbvTegOw5FKpT%2BzdPVOoq5N&s=be6ec883b9846ec07ebc65a9eb80278b&i=3875A4218A1A15249"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3916"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3240 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
28 753
Read events
28 589
Write events
120
Delete events
44

Modification events

(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091415
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091415
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
2
Suspicious files
58
Text files
56
Unknown types
16

Dropped files

PID
Process
Filename
Type
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:EB84B8EA457D15F046BD573725BADBDD
SHA256:CE9318DF1081AD3786148862F024AC7A104B09C41A52BC9B9050A3E5F72EEDC5
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:2621DD5D67B97112B1B8F0311C22CBE0
SHA256:A5EF483D5F52F45371C362092E58B3D299A3233907DC0296476E9F9860C33241
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B40C4FD2DD24A9A07FF85824E7CD5D4F
SHA256:FE5838C562EDD5E79D5D56D607B6DE565D7FCC96F3FADAD0D745B5406094EAFB
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:41AEA8163E6956B66E783889F2353318
SHA256:699BE7BFEB9B64F78A3293DC2383C903D5ADBC8CF20B3E6452820CA93205F20E
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517der
MD5:109B095F52A39759254DFF4B002DFA03
SHA256:7D84582B78964DF7820F831B550D69AD60E906CBA15166F0DC2B09F058B78004
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\83D863F495E7D991917B3ABB3E1EB382_1CF3CD648CFFE038A8327ADAF3322CD2binary
MD5:3F53DF4ABB759A712DA258BE46F6ACCF
SHA256:03F374B0B6661F2B5EADFB4537185A8E2398EFBAF29B0F8420479364E8DC9FD9
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_1CF3CD648CFFE038A8327ADAF3322CD2der
MD5:12FE0A5E1A0F680A5DC722B9345EDEE0
SHA256:79AA45DDAD19DB5544E8F3473244CD85FCC508AD8BDF38B794A458009F5B1000
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:FD66ADDD22F049518BC196F28543DFC3
SHA256:05ABB5EB90A022BE4B8BAEDC2B3118A19984179CFFEE2B66F27309717A791B70
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:45D25CDF11FF2D31AFA92052883A6B28
SHA256:CBD3AF4EDA1BB97E5791B3EB7F3FD250EC2970CB6A6054F7276787B9A59D6949
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
50
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
iexplore.exe
GET
304
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3916
iexplore.exe
GET
304
23.32.238.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3916
iexplore.exe
GET
200
18.239.15.14:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3916
iexplore.exe
GET
200
18.65.41.80:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
3916
iexplore.exe
GET
200
18.65.41.80:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
binary
1.37 Kb
unknown
3916
iexplore.exe
GET
200
23.32.238.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a08f35fbea17b647
unknown
compressed
67.5 Kb
unknown
3916
iexplore.exe
GET
200
69.192.161.44:80
http://x2.c.lencr.org/
unknown
binary
299 b
unknown
3916
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3916
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEH1ZfRmkcbmIEJt1GKpWSOU%3D
unknown
binary
471 b
unknown
3916
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3916
iexplore.exe
54.80.179.254:443
connectfansus.lt.acemlna.com
AMAZON-AES
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3916
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3916
iexplore.exe
23.32.238.226:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3916
iexplore.exe
18.239.15.14:80
o.ss2.us
—
US
unknown
3916
iexplore.exe
18.65.41.80:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
unknown
3916
iexplore.exe
18.239.62.218:80
ocsp.r2m03.amazontrust.com
—
US
unknown
3916
iexplore.exe
34.76.180.229:443
pagamento.ogrupoimpulse.com
GOOGLE-CLOUD-PLATFORM
BE
unknown

DNS requests

Domain
IP
Reputation
connectfansus.lt.acemlna.com
  • 54.80.179.254
  • 44.218.130.238
  • 44.218.248.61
unknown
ctldl.windowsupdate.com
  • 23.32.238.226
  • 23.32.238.178
  • 23.32.238.242
  • 23.32.238.201
  • 23.32.238.225
  • 23.32.238.232
whitelisted
o.ss2.us
  • 18.239.15.14
  • 18.239.15.192
  • 18.239.15.186
  • 18.239.15.174
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.65.41.80
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.65.41.80
shared
ocsp.r2m03.amazontrust.com
  • 18.239.62.218
unknown
pagamento.ogrupoimpulse.com
  • 34.76.180.229
unknown
x1.c.lencr.org
  • 69.192.161.44
whitelisted
virtualaassistant.com
  • 76.76.21.21
unknown
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://connectfansus.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwYWdhbWVudG8ub2dydXBvaW1wdWxzZS5jb20lMkZMR2tO&sig=HEz1yAE3AnqPuE1E5x2B85npNv9apJBriEfD1oZFcDeu&iat=1709127434&a=%7C%7C801579481%7C%7C&account=connectfansus.activehosted.com&email=RWpwN3ZZGJSMM3y4VAS9azF01WqVKzNpZVcpdrf6UFhM8Ew%3D%3AQ7K7ypPXKwbvTegOw5FKpT%2BzdPVOoq5N&s=be6ec883b9846ec07ebc65a9eb80278b&i=3875A4218A1A15249